Call the Google Search Console MCP server over HTTP

How to call the GSC PAP MCP server over HTTP

1. 1

   Sign in to GSC PAP and copy your token

   Go to gscpap.com and click "Sign in with Google." Approve the read-only access it asks for. The connect page then shows your bearer token once, so copy it now. If you lose it, create a new one at app.gscpap.com/account/tokens; your other tokens keep working.

2. 2

   Send the initialize request

   POST a JSON-RPC initialize request with your token in the Authorization header, and send the Accept header exactly as shown. The server replies with HTTP 200 and a text/event-stream body: an event: message line, then a data: line holding the JSON-RPC result with the server's name, protocol version and capabilities. It does not return an Mcp-Session-Id header.

   shellCopy

   curl -X POST https://mcp.gscpap.com/mcp \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "initialize",
       "params": {
         "protocolVersion": "2025-06-18",
         "capabilities": {},
         "clientInfo": {"name": "curl", "version": "1.0"}
       }
     }'

3. 3

   List the tools

   Call tools/list to get every tool with its description and input schema. The server runs in stateless mode, so this request needs no session ID and nothing from the initialize response. The sed and jq part strips the event-stream framing and prints only the tool names; drop it to see the full response.

   shellCopy

   curl -s -X POST https://mcp.gscpap.com/mcp \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list"}' \
     | sed -n 's/^data: //p' | jq -r '.result.tools[].name'

4. 4

   Call a tool

   Use tools/call with the tool's name and an arguments object that matches its input schema. list_sites takes no arguments and returns your verified Search Console properties as JSON text in result.content. Swap in any other tool name from tools/list.

   shellCopy

   curl -X POST https://mcp.gscpap.com/mcp \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{
       "jsonrpc": "2.0",
       "id": 3,
       "method": "tools/call",
       "params": {
         "name": "list_sites",
         "arguments": {}
       }
     }'

Calling the server directly: common issues

• ·Send Accept: application/json, text/event-stream. If you accept only application/json, the server rejects the request with "Not Acceptable: Client must accept both application/json and text/event-stream".
• ·Responses use event-stream framing even for a single result, so read the JSON from the data: line instead of parsing the whole body as JSON.
• ·A missing, wrong or revoked token gets HTTP 401 before the request reaches the MCP layer, with a WWW-Authenticate header that points at the server's OAuth metadata. Check the status code first.
• ·Every authenticated MCP call counts toward the rate limits, tools/list included: 30 per minute and 500 per hour for each token, and 60 per minute and 1,000 per hour for your account across all its tokens. Over a limit, the server returns a JSON-RPC error that says how many seconds to wait.
• ·For Python agents, the official mcp package (pip install mcp) handles the handshake and the event-stream parsing for you. Prefer it over raw curl unless you are writing a one-off shell script.
• ·curl -v prints your Authorization header. Remove that line from any output you share for support.

Frequently asked questions